I am trying to figure out a way to get an alert when users have not used an office program in X amount of days, or some type of report just showing all the users with the last time office was used.
I know the Event Viewer has a section under Applications and Services logs called Microsoft Office Alerts that I was planning on getting Information Alerts from. However, in Kaseya > Monitor > Agent Monitoring > Event Log Alerts there is no Microsoft Office Alerts section of the "Select event log type". (We use the SaaS version of Kaseya)
Thanks for the tip. I submitted and ticket and received a reply that we would receive an update for Kaseya at an unknown release date.
The PowerShell code you provided seems to be for an older version of Office. If anyone else comes across this problem and is using Office 365/Office 15, use this code:
(Get-EventLog -LogName "OAlerts" -Source "Microsoft Office 15 Alerts" -EntryType "Information" -Newest 1).TimeGenerated;
Can you show us this Event Log Type you are trying to monitor?
Also, do you have a specific Microsoft Office Event ID you are looking for to track this?
There possibly could be a few ways to accomplish this.
Hi Nicolas Ponce,
Below is the Event Log I am trying to track.
I am looking for a way to use Kaseya to check whether the Office 365 licenses we have assigned are still being used/active on the end computers.(i.e. if someone leaves the company and we forget to remove them from our Office 365 Active Users list). I thought this could be accomplished by checking whether or not an Office program has been used, which seems to be able to be seen from the event log shown above.
The first thing I recommend is that you review the public (free) training material on event logs alerts if you have not had an opportunity to do this already. To find the lesson, navigate to university.kaseya.com and login (create a free account if you do not have one already). Once logged in, expand the Kaseya University Public Curriculum category and find the VSA Technician Learning path section. Within this section, there are many free self-paced training lessons. The course M4. Monitor: Event Log Alerts would be the one most applicable to the problem you're currently trying to address. Among other things, this lesson will give you an understanding of how to create custom event log alerts.
Once you have an understanding of creating and reviewing event log alerts with Kaseya, you might be able to use the information you have already to create your own alert. I'm sure that the community, including Nicolas Ponce, will be happy to provide you with additional guidance as time allows, but this is a way you can continue to make forward progress while waiting for suggestions from others. I know that doesn't directly answer the problem you are trying to solve, but with the free training options we have available, it may be enough to get you going in the right direction.
Thank you for the recommendation. I have reviewed that and this link: helpdesk.kaseya.com/.../89356208-How-do-I-monitor-a-Windows-Event- prior to posting in the community. The issue I seem to be facing is that the "Event Log Type" is not listed in the drop down menu. It seems that it would be need to be named "Microsoft Office Alerts" but in the "Select Event Log Type" drop down menu, the closest thing to that is "Microsoft Office Web App"
I believe there is an issue in 9.2 and 9.0 with Update Lists by Scan not populating new Custom Event Log Types if they do not already exist in the system.
Since you are on our hosted platform, I would advise you create a support ticket and ask it to be associated to the problem ticket for this (86466) and they update you when this patch is released for 9.2 and applied to your instance on SaaS.
In the interim -
It does look like Microsoft Office will generate an event log on this in an older version (2007) but this, too, is logged in a custom event log type.
If you see similar you can try the following powershell example to query the last time office was started:
(Get-EventLog -LogName "OSession" -Source "Microsoft Office 12 Sessions" -EntryType "Information" -Message "*Microsoft Office*session lasted*" -Newest 1).TimeGenerated;
You can build the powershell script, upload to managed files, and push+call it directly from Agent Procedures.
The event log may differ for the version of Office you are using.